Exploit Warning: Public PoC Released for Microsoft Exchange SSRF Vulnerability CVE-2026-45504
Executive Summary
A high-severity Server-Side Request Forgery (SSRF) vulnerability in on-premises Microsoft Exchange Server has been publicly disclosed alongside a functional proof-of-concept (PoC) exploit. Tracked as CVE-2026-45504 and carrying a CVSS score of 8.8, the flaw allows authenticated, low-privileged users to read arbitrary files from vulnerable Exchange servers. Disclosed by security researchers at HawkTrace, the vulnerability represents an immediate operational hazard for enterprise networks still running on-premises email deployments.
Deep-Dive Technical Analysis
Microsoft Exchange Server is a widely deployed mail server that handles sensitive corporate communications, calendaring, and internal directories. Because of its core role in corporate workflows, Exchange is a prime target for both cybercriminals and state-sponsored espionage groups.
A technical analysis of CVE-2026-45504 reveals a significant flaw in how Exchange processes external URLs:
1. The Core Defect (OneDriveProUtilities Flaw): The vulnerability resides within the OneDriveProUtilities component of Microsoft Exchange. Specifically, functions such as TryTwice and GetWacUrl fail to properly sanitize and validate external URLs provided during attachment previews or when integrating with SharePoint services.
2. SSRF Execution Flow: An authenticated, low-privileged user can send a crafted HTTP request containing a malformed external URL to these vulnerable functions. The Exchange server attempts to connect to the provided URL, allowing the attacker to coerce the server into making outbound request calls.
3. Arbitrary File Reading: By manipulating the request parameters, attackers can exploit this SSRF vulnerability to read local system configuration files, access sensitive directory data, or harvest administrative credentials stored on the Exchange server.
4. Bypassing MFA and Identity Gates: Because the exploit is executed by the server itself, it bypasses external firewalls and multi-factor authentication (MFA) gates. Additionally, any standard employee account (including those compromised via phishing) can be used to launch the exploit, posing a severe threat to large environments.
Industry Impact and Recommendations
The disclosure of a public PoC exploit for CVE-2026-45504 significantly increases the likelihood of active exploitation. Attackers routinely monitor public repositories for PoC code to integrate into their automated scanning and exploit tools, making immediate remediation essential.
We recommend that all system administrators, network engineers, and security architects implement the following immediate defensive measures:
1. Apply Microsoft Cumulative Patches Immediately: Upgrade all on-premises Microsoft Exchange Server installations to the latest patched firmware versions released by Microsoft.
2. Restrict Outbound Network Connections from Exchange: Configure strict firewall rules to block the Exchange server from initiating unauthorized, outbound HTTP or HTTPS connections to the public internet, limiting the ability of the server to execute SSRF requests.
3. Audit Exchange Access Logs: Regularly audit IIS and Exchange logs for anomalous, high-frequency requests directed at OneDriveProUtilities endpoints, specifically monitoring for requests containing external or unfamiliar URLs.
4. Enforce Least Privilege for Mailbox Accounts: Ensure standard user and service accounts do not possess unnecessary administrative privileges on the Exchange server, limiting the potential blast radius of a compromised account.
References
* Cybersecurity News
* Hacker News — SharePoint KEV Alert